Vulnerabilities in Atlassian Products · CIAD-2025-0045
CERT-In advisory CIAD-2025-0045 · 21 Nov 2025
Official title
CIAD-2025-0045 : Multiple Vulnerabilities in Atlassian Products
Official record
Open source pageSummary
Check the official recordWhat changed
CERT-In reports multiple critical vulnerabilities in Atlassian products that allow attackers to execute arbitrary code, perform command injection, or cause denial of service. Affected systems include Bitbucket, Confluence, Jira, and Jira Service Management Data Center and Server versions. These vulnerabilities also permit unauthorized access to sensitive information, server-side request forgery, and path traversal. Users must apply the security updates provided in the official Atlassian security bulletin to mitigate these risks.
What you must do
- Apply the security updates specified in the Atlassian security bulletin.
Key dates
- Original Issue Date
- 21 Nov 2025
Who is affected
Document text
CERT-In Advisory CIAD-2025-0045
Multiple Vulnerabilities in Atlassian Products
Original Issue Date: November 21, 2025
Severity Rating: Critical
Systems Affected
Bitbucket Data Center and Server Confluence Data Center and Server Jira Data Center and Server Jira Service Management Data Center and Server
Overview
Multiple vulnerabilities have been reported in Atlassian Products which could allow an attacker to execute arbitrary code, perform Command Injection, Prototype Pollution, Open Redirect, Cryptographic Failure, Path Traversal, Improper Authorization, SSRF (server-side request forgery) attack, obtain sensitive information and cause Denial of Service (DoS) condition on the targeted system.
Target Audience:
Individuals and organisational users of the above mentioned Atlassian Products.
Risk Assessment:
High risk of Remote Code Execution (RCE), SSRF (Server-Side Request Forgery), DoS (Denial of Service).
Impact Assessment:
Potential for unauthorized access to sensitive data or service disruption.
Description
Atlassian products are used by software development teams, IT operations, project management professionals and business teams. Some of the key products in the Atlassian suite include Bitbucket, Jira and Confluence.
Multiple vulnerabilities have been reported in various Atlassian Products; Details of which are provided below:
Solution
Apply appropriate updates as mentioned in Atlassian security bulletin:
https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html
References
Atlassian
https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html
CVE Name
CVE-2024-38999 CVE-2016-1000027 CVE-2023-42282 CVE-2023-45133 CVE-2025-48734 CVE-2025-55163 CVE-2024-25710 CVE-2024-29415 CVE-2024-22259 CVE-2024-21538 CVE-2023-52428 CVE-2024-45590 CVE-2021-3803 CVE-2022-31129 CVE-2021-3807 CVE-2024-4068 CVE-2022-24785 CVE-2021-33587 CVE-2025-41248 CVE-2022-24772 CVE-2024-38819 CVE-2022-24771 CVE-2025-22228 CVE-2020-8203 CVE-2020-28471 CVE-2025-22235 CVE-2023-26159 CVE-2021-23337 CVE-2022-46175 CVE-2025-48387 CVE-2025-22166 CVE-2024-37890 CVE-2022-38900 CVE-2024-45296 CVE-2025-48976
Source details
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 21 Nov 2025
- Document number
- CIAD-2025-0045
- Issuing division
- CERT-In
- Coverage area
- cybersecurity